scanner

package
v0.8.1 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Mar 24, 2026 License: MIT Imports: 18 Imported by: 0

Documentation

Overview

Package scanner provides secret scanning functionality using gitleaks

Index

Constants

This section is empty.

Variables

View Source
var ErrSecretsFound = errors.New("secrets found")

ErrSecretsFound signals secrets were detected (used for exit code mapping)

Functions

This section is empty.

Types

type Finding

type Finding struct {
	Description string
	File        string
	Fingerprint string // Unique identifier for .gitleaksignore
	Line        int
	Match       string // Redacted snippet
	RuleID      string
	Secret      string // Redacted
}

Finding represents a detected secret

type GitleaksScanner

type GitleaksScanner struct {
	// contains filtered or unexported fields
}

GitleaksScanner implements Scanner using embedded gitleaks

func NewGitleaksScanner

func NewGitleaksScanner() (*GitleaksScanner, error)

NewGitleaksScanner creates a scanner with default gitleaks config

func (*GitleaksScanner) LoadIgnoreFile added in v0.7.0

func (s *GitleaksScanner) LoadIgnoreFile(directory string) error

LoadIgnoreFile loads a .gitleaksignore file from the specified directory. Entries in the ignore file are fingerprints that should be excluded from scan results. If the ignore file does not exist, this method returns nil (silent).

func (*GitleaksScanner) Scan

func (s *GitleaksScanner) Scan(ctx context.Context, path string, scanConfig *ScanConfig) (*ScanResult, error)

Scan scans a directory for secrets

func (*GitleaksScanner) ScanFile

func (s *GitleaksScanner) ScanFile(ctx context.Context, path string, scanConfig *ScanConfig) (*ScanResult, error)

ScanFile scans a single file for secrets

func (*GitleaksScanner) ScanString

func (s *GitleaksScanner) ScanString(_ context.Context, content string) *ScanResult

ScanString scans a string for secrets (useful for env vars, commands)

type ScanConfig

type ScanConfig struct {
	Exclude     []string
	MaxFileSize int
}

ScanConfig holds scanner configuration

func DefaultScanConfig

func DefaultScanConfig() *ScanConfig

DefaultScanConfig returns sensible defaults

type ScanResult

type ScanResult struct {
	Duration    time.Duration
	Findings    []Finding
	ScannedPath string
}

ScanResult contains the results of a secret scan

func (*ScanResult) HasFindings

func (r *ScanResult) HasFindings() bool

HasFindings returns true if any secrets were found

type Scanner

type Scanner interface {
	LoadIgnoreFile(directory string) error
	Scan(ctx context.Context, path string, scanConfig *ScanConfig) (*ScanResult, error)
	ScanFile(ctx context.Context, path string, scanConfig *ScanConfig) (*ScanResult, error)
	ScanString(ctx context.Context, content string) *ScanResult
}

Scanner defines the interface for secret scanning

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL